Bumps [azure/login](https://github.com/azure/login) from 1.6.1 to 2.0.0.
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@cb79c77...8c334a1)

---
updated-dependencies:
- dependency-name: azure/login
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

…2041)

This is the new apt repo

…#2042)

Add a feature to make the Garden Linux image as compliant as possible to the [Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide](https://www.stigviewer.com/stig/canonical_ubuntu_20.04_lts/2023-09-08/)

Note that some items in that STIG simply don't apply to Garden Linux, for example it does not contain a GUI or AppArmor.

STIG-specific configuration is encapsulated in the 'stig' feature. To opt in into it, build your image with that feature enabled. Note that this might break other features.

The 'stigDev' feature provides a known user/password and ssh key for the purpose of testing. This feature is only intended for development/testing purposes, not for production.

So far the SapMachine version we include needs to be updated manually.

This PR adds a script to help with that, but the update is still a manual process.

The script finds the latest minor/patch version of a given major version along with the checksums of the tarballs.

Running `update-sapmachine.py` will print out the variables to be used in `exec.config`.
A potential improvement is to edit the `exec.config` script automatically via `update-sapmachine.py`.

We still want the checksum and the exact SapMachine version to be stored in the git repo, so we don't want to hide this by automatically running `update-sapmachine.py` during the build for reproducibility reasons.

Co-authored-by: Vincent Riesop <v.riesop@sap.com>

…x#2046)

Bumps [boto3](https://github.com/boto/boto3) from 1.34.55 to 1.34.65.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.55...1.34.65)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Remove docker from gardener feature

* Remove docker-in-gardener-specific test

…rs_tests

feat: add tests for bare flavours

…x#2060)

* security update annotations are not tracked in package repository,
but in security tracker and other internal tooling.
* new package pipeline does not contain annotations for CVEs, thus
we need to remove the packages updates section in the release page automation
=> need to include it manually

Bumps [actions/cache](https://github.com/actions/cache) from 4.0.1 to 4.0.2.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@ab5e6d0...0c45773)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

…b_actions/azure/login-2.0.0

build(deps): bump azure/login from 1.6.1 to 2.0.0

…b_actions/actions/cache-4.0.2

build(deps): bump actions/cache from 4.0.1 to 4.0.2

* Stop building openstack and vmware for arm64

Those builds fail because of missing open-vm-tools for arm64.

Disable builds as they have no consumers anyways.

* fix s3 upload

* update LICENSE date
* improve readme
* badge showing latest LTS version of Garden Linux
* simple quick start sections: build, test, download
* remove unecessary license badge. we have LICENSE.md file which is commin practise and Github also displays it in UI
* remove toc. README is simple enough.
* add reference to bare container
* add reference to base container
* add reference to nvidia installer
* remove details about integration tests. Details are explained in developer docs. User readind README only needs to know how to test locally and that we test automatically

Co-authored-by: Florian Wilhelm <florian.wilhelm02@sap.com>

This PR introduces a workflow for building disk images and yaml manifest for use with lima-vm. Uploading those build artefacts will be done in a separate PR.

Co-authored-by: Vincent Riesop <v.riesop@sap.com>

Bumps [idna](https://github.com/kjd/idna) from 3.6 to 3.7.
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst)
- [Commits](kjd/idna@v3.6...v3.7)

---
updated-dependencies:
- dependency-name: idna
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…nux#2070)

[no ci] Bumps [azure-cli](https://github.com/Azure/azure-cli) from 2.57.0 to 2.59.0.
- [Release notes](https://github.com/Azure/azure-cli/releases)
- [Changelog](https://github.com/Azure/azure-cli/blob/dev/doc/try_new_features_before_release.md)
- [Commits](Azure/azure-cli@azure-cli-2.57.0...azure-cli-2.59.0)

---
updated-dependencies:
- dependency-name: azure-cli
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…linux#2063)

[no ci] Bumps [google-auth](https://github.com/googleapis/google-auth-library-python) from 2.28.1 to 2.29.0.
- [Release notes](https://github.com/googleapis/google-auth-library-python/releases)
- [Changelog](https://github.com/googleapis/google-auth-library-python/blob/main/CHANGELOG.md)
- [Commits](googleapis/google-auth-library-python@v2.28.1...v2.29.0)

---
updated-dependencies:
- dependency-name: google-auth
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

gardenlinux#2062)

[no ci] Bumps [google-cloud-storage](https://github.com/googleapis/python-storage) from 2.15.0 to 2.16.0.
- [Release notes](https://github.com/googleapis/python-storage/releases)
- [Changelog](https://github.com/googleapis/python-storage/blob/main/CHANGELOG.md)
- [Commits](googleapis/python-storage@v2.15.0...v2.16.0)

---
updated-dependencies:
- dependency-name: google-cloud-storage
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ardenlinux#2029)

[no ci] Bumps [azure-identity](https://github.com/Azure/azure-sdk-for-python) from 1.16.0b1 to 1.16.0b2.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-python/blob/main/doc/esrp_release.md)
- [Commits](Azure/azure-sdk-for-python@azure-identity_1.16.0b1...azure-identity_1.16.0b2)

---
updated-dependencies:
- dependency-name: azure-identity
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* gh: create config for auto changelog generation

* GitHub supports the generation of automatic release notes based on PRs. 
* PRs can be filtered and sorted into categories via PR labels
* more details: https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes

* gh: remove unused labels in changelog config

Co-authored-by: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>

* every platform requires an info.yaml.

…gardenlinux#2074)

* fix gdch: exclude systemd-timesyncd in favour of chrony

* fix gdch: exclude irqbalance

…sts (gardenlinux#2076)

Bumps [aliyun-python-sdk-core](https://github.com/aliyun/aliyun-openapi-python-sdk) from 2.14.0 to 2.15.1.
- [Commits](https://github.com/aliyun/aliyun-openapi-python-sdk/commits)

---
updated-dependencies:
- dependency-name: aliyun-python-sdk-core
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

gardenlinux#2078)

Bumps [azure-storage-blob](https://github.com/Azure/azure-sdk-for-python) from 12.19.0 to 12.19.1.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-python/blob/main/doc/esrp_release.md)
- [Commits](Azure/azure-sdk-for-python@azure-storage-blob_12.19.0...azure-storage-blob_12.19.1)

---
updated-dependencies:
- dependency-name: azure-storage-blob
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ardenlinux#2079)

Bumps [python-novaclient](https://docs.openstack.org/python-novaclient/latest) from 18.5.0 to 18.6.0.

---
updated-dependencies:
- dependency-name: python-novaclient
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ardenlinux#2080)

Bumps [azure-identity](https://github.com/Azure/azure-sdk-for-python) from 1.16.0b2 to 1.16.0.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-python/blob/main/doc/esrp_release.md)
- [Commits](Azure/azure-sdk-for-python@azure-identity_1.16.0b2...azure-identity_1.16.0)

---
updated-dependencies:
- dependency-name: azure-identity
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

)

Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.3 to 8.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@7.4.3...8.1.1)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* tests: add kernel config tests

Tests for cloud and metal feature. Check if
SGX configs are enabled and check if MAGIC_SYSRQ config is disabled

MAGIC_SYSRQ must be disabled for security audit reasons

* remove old unused kernel config test

* add exact test

* refactor: add rational, arch and key/value tuple

* also change test_kernel_config of metal

* Build with SELinux enabled

Possible thanks to gardenlinux/builder#73

Tested with podman machine on macos with a new vm that has SELinux enabled

* fix: renamed systemd pcrphase binary

* Use newer builder image

Includes this fix gardenlinux/builder@191279b

---------

Co-authored-by: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>

…x#2089)

Bumps [boto3](https://github.com/boto/boto3) from 1.34.65 to 1.34.89.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.65...1.34.89)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

)

Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.3 to 8.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@7.4.3...8.1.1)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

gardenlinux#2087)

Bumps [python-openstackclient](https://docs.openstack.org/python-openstackclient/latest/) from 6.5.0 to 6.6.0.

---
updated-dependencies:
- dependency-name: python-openstackclient
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [azure/login](https://github.com/azure/login) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@8c334a1...6b24568)

---
updated-dependencies:
- dependency-name: azure/login
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

)

Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.3 to 8.2.0.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@7.4.3...8.2.0)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ardenlinux#2097)

Bumps [redhat-plumbers-in-action/differential-shellcheck](https://github.com/redhat-plumbers-in-action/differential-shellcheck) from 5.1.1 to 5.1.2.
- [Release notes](https://github.com/redhat-plumbers-in-action/differential-shellcheck/releases)
- [Changelog](https://github.com/redhat-plumbers-in-action/differential-shellcheck/blob/main/docs/CHANGELOG.md)
- [Commits](redhat-plumbers-in-action/differential-shellcheck@c150708...52bab0c)

---
updated-dependencies:
- dependency-name: redhat-plumbers-in-action/differential-shellcheck
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [aliyun-python-sdk-ecs](http://develop.aliyun.com/sdk/python) from 4.24.71 to 4.24.72.

---
updated-dependencies:
- dependency-name: aliyun-python-sdk-ecs
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…x#2095)

Bumps [boto3](https://github.com/boto/boto3) from 1.34.89 to 1.34.94.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.89...1.34.94)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

)

Bumps [oss2](https://github.com/aliyun/aliyun-oss-python-sdk) from 2.18.4 to 2.18.5.
- [Release notes](https://github.com/aliyun/aliyun-oss-python-sdk/releases)
- [Changelog](https://github.com/aliyun/aliyun-oss-python-sdk/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/aliyun/aliyun-oss-python-sdk/commits)

---
updated-dependencies:
- dependency-name: oss2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Rootless podman feature

WIP, currently not building because slirp4netns is missing in repo

* bootstrap unit tests

* fix sed

gardenlinux#2101)

In this commit we imitation the fix[0] for `_secureboot`. Since systemd
255 has renamed the  naming from pcrextend to pcrphase. Without the
build fails:

    building raw image kvm-python_dev_readonly-amd64-today
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] using base fstab: /builder/features/base/fstab
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] modifying fstab with /builder/features/_readonly/fstab.mod
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] ---- fstab ----
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] LABEL=EFI    /efi    vfat    ro,umask=0077    type=uefi,size=128MiB
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] LABEL=USR    /usr         ext4    ro               verity
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] REPART=00    /            ext4    rw               ephemeral
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] ---------------
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] mke2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Discarding device blocks: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Creating filesystem with 123648 4k blocks and 123648 inodes
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Filesystem UUID: 574aaca1-0e64-d36a-f743-e943b6bbca85
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Superblock backups stored on blocks:
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47]      32768, 98304
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Allocating group tables: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Writing inode tables: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Creating journal (4096 blocks): done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] Copying files into the device: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] Writing superblocks and filesystem accounting information: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] tune2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] resize2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] The filesystem is already 123648 (4k) blocks long.  Nothing to do!
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] resize2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] Resizing the filesystem on /tmp/tmp.NQarjGu1rf to 128000 (4k) blocks.
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] The filesystem on /tmp/tmp.NQarjGu1rf is now 128000 (4k) blocks long.
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:03] /usr 5c3c3ad846e38b5b137e5483134ef1518b67eb4cdee901a2ad80556efc1ffcec  /tmp/tmp.NQarjGu1rf
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] VERITY header information for /tmp/tmp.NQarjGu1rf.verity
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] UUID:                b22d938d-1a08-3803-f9fe-e56a1f5bf88b
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash type:           1
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Data blocks:         128000
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Data block size:     4096
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash blocks:         1009
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash block size:     4096
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash algorithm:      sha256
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Salt:                59cdd7476f7045846a89fb0743b0508cc366b6dfa40a4fc6e3e6e6df095f6ad5
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Root hash:           cf485e037bd039c77ebe06c196f11ca553c49408f8e8d5e461f2f40c7255e392
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash device size:    4136960 [bytes]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] ERROR: ld.so: object 'datefudge.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] /efi ce715d6156ecbde3caf8b52818a27515ae678c1fc3da7167905c7b5c39ae7bdc  /tmp/tmp.FpyBisxA15
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] /usr/bin/dracut: line 1067: /sys/module/firmware_class/parameters/path: No such file or directory
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] dracut[I]: Executing: /usr/bin/dracut --no-hostonly --force --kver 6.6.30-cloud-amd64 --modules "bash dash systemd systemd-initrd systemd-veritysetup systemd-repart kernel-modules kernel-modules-extra terminfo udev-rules dracut-systemd base fs-lib shutdown crypt systemd-pcrphase " --install "/etc/veritytab cryptsetup head mkfs.ext4 systemd-escape lsblk" --include /tmp/tmp.uQc9lA1NcJ / --reproducible /tmp/tmp.xSSK9wE6VQ
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] dracut[I]: Module 'systemd-pcrphase' will not be installed, because command '/usr/lib/systemd/systemd-pcrphase' could not be found!
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] dracut[E]: Module 'systemd-pcrphase' cannot be installed.
    completed in 107 seconds

He also exepcts tpm2 to be preseted now. Hence adding it to the
packages. As of now this fixes the build. I'm unsure if the build will
work correctly. Since it will fail as follows:

    [  OK  ] Reached target initrd-root-device.target - Initrd Root Device.
    [    3.877478] systemd-repart[383]: Automatically determined minimal disk image size as 599.0M, current image size is 584.0M.
    [    3.878989] systemd[1]: systemd-repart.service: Main process exited, code=exited, status=1/FAILURE
    [    3.880320] systemd[1]: systemd-repart.service: Failed with result 'exit-code'.
    [    3.881512] systemd[1]: Failed to start systemd-repart.service - Repartition Root Disk.
    [    3.882701] systemd[1]: Reached target initrd-root-device.target - Initrd Root Device.

But this might be a different issue.

* add hack/enable_inactive_workflows script
* make shellcheck happy

What:
- repair `non_gcp` flag for python platform tests
- add a second umask test `test_umask_cmd` (check via `umask`) 
- disable `test_umask` for platform gcp tests (check by reading UMASK value from /etc/login.defs) 

Why we need these tests:
- pam_umask reads the umask value from /etc/login.defs: we need to test /etc/login.defs
- `/root/.bashrc`, `/root/.profile`, ... can overwrite default value from /etc/login.defs
    - ➡️  we need to check via umask cmd in root bash environment

Conclusion: 
- We need both tests. Disabling `/etc/login.defs` for gcp only is only acceptable, because we additionally have chroot tests that still check the file content.

…ardenlinux#2103)

Bumps [redhat-plumbers-in-action/differential-shellcheck](https://github.com/redhat-plumbers-in-action/differential-shellcheck) from 5.1.2 to 5.2.0.
- [Release notes](https://github.com/redhat-plumbers-in-action/differential-shellcheck/releases)
- [Changelog](https://github.com/redhat-plumbers-in-action/differential-shellcheck/blob/main/docs/CHANGELOG.md)
- [Commits](redhat-plumbers-in-action/differential-shellcheck@52bab0c...227e162)

---
updated-dependencies:
- dependency-name: redhat-plumbers-in-action/differential-shellcheck
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix: /etc/login.defs permissions

…ux#2115)

updated-dependencies:
- dependency-name: pylint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ux#2120)

updated-dependencies:
- dependency-name: requests
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…rom 5.2.0 to 5.3.0 (gardenlinux#2118)

updated-dependencies:
- dependency-name: redhat-plumbers-in-action/differential-shellcheck
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…denlinux#2119)

updated-dependencies:
- dependency-name: google-github-actions/auth
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

)

updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Turns out that the change in dracut isn't stable. The pcrextend is
missing in my latest build, breaking readonly again. Hence, I'll keep
the change here after all.

…md-pcrextend

In this commit, we copy the fix\[0\] for `_secureboot`. Since systemd 255 has renamed the naming from `pcrextend` to `pcrphase.` Without the build fails:

    building raw image kvm-python_dev_readonly-amd64-today
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] using base fstab: /builder/features/base/fstab
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] modifying fstab with /builder/features/_readonly/fstab.mod
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] ---- fstab ----
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] LABEL=EFI    /efi    vfat    ro,umask=0077    type=uefi,size=128MiB
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] LABEL=USR    /usr         ext4    ro               verity
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] REPART=00    /            ext4    rw               ephemeral
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:22] ---------------
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] mke2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Discarding device blocks: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Creating filesystem with 123648 4k blocks and 123648 inodes
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Filesystem UUID: 574aaca1-0e64-d36a-f743-e943b6bbca85
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Superblock backups stored on blocks:
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47]      32768, 98304
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Allocating group tables: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Writing inode tables: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:47] Creating journal (4096 blocks): done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] Copying files into the device: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] Writing superblocks and filesystem accounting information: done
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] tune2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] resize2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] The filesystem is already 123648 (4k) blocks long.  Nothing to do!
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] resize2fs 1.47.1-rc2 (01-May-2024)
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] Resizing the filesystem on /tmp/tmp.NQarjGu1rf to 128000 (4k) blocks.
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55] The filesystem on /tmp/tmp.NQarjGu1rf is now 128000 (4k) blocks long.
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:00:55]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:03] /usr 5c3c3ad846e38b5b137e5483134ef1518b67eb4cdee901a2ad80556efc1ffcec  /tmp/tmp.NQarjGu1rf
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] VERITY header information for /tmp/tmp.NQarjGu1rf.verity
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] UUID:                b22d938d-1a08-3803-f9fe-e56a1f5bf88b
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash type:           1
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Data blocks:         128000
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Data block size:     4096
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash blocks:         1009
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash block size:     4096
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash algorithm:      sha256
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Salt:                59cdd7476f7045846a89fb0743b0508cc366b6dfa40a4fc6e3e6e6df095f6ad5
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Root hash:           cf485e037bd039c77ebe06c196f11ca553c49408f8e8d5e461f2f40c7255e392
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] Hash device size:    4136960 [bytes]
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] ERROR: ld.so: object 'datefudge.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:04] /efi ce715d6156ecbde3caf8b52818a27515ae678c1fc3da7167905c7b5c39ae7bdc  /tmp/tmp.FpyBisxA15
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] /usr/bin/dracut: line 1067: /sys/module/firmware_class/parameters/path: No such file or directory
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] dracut[I]: Executing: /usr/bin/dracut --no-hostonly --force --kver 6.6.30-cloud-amd64 --modules "bash dash systemd systemd-initrd systemd-veritysetup systemd-repart kernel-modules kernel-modules-extra terminfo udev-rules dracut-systemd base fs-lib shutdown crypt systemd-pcrphase " --install "/etc/veritytab cryptsetup head mkfs.ext4 systemd-escape lsblk" --include /tmp/tmp.uQc9lA1NcJ / --reproducible /tmp/tmp.xSSK9wE6VQ
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] dracut[I]: Module 'systemd-pcrphase' will not be installed, because command '/usr/lib/systemd/systemd-pcrphase' could not be found!
    [.build/kvm-python_dev_readonly-amd64-today-local.raw 2024-05-08 11:02:09] dracut[E]: Module 'systemd-pcrphase' cannot be installed.
    completed in 107 seconds

He also expects tpm2 to be present now. Hence, adding it to the packages. Lastly, we check for the `pcrphase` binary and only linking it when it's missing. This should have been fixed upstream, however, there might be a regression.

Fixes: gardenlinux#2108

…2123)

We were missing the target_commitish parameter which means that github
is using main branch instead.

Docs:
https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28#create-a-release

updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

gardenlinux#2110)

Bumps [azure-storage-blob](https://github.com/Azure/azure-sdk-for-python) from 12.19.1 to 12.20.0.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-python/blob/main/doc/esrp_release.md)
- [Commits](Azure/azure-sdk-for-python@azure-storage-blob_12.19.1...azure-storage-blob_12.20.0)

---
updated-dependencies:
- dependency-name: azure-storage-blob
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…nux#2104)

Bumps [azure-cli](https://github.com/Azure/azure-cli) from 2.59.0 to 2.60.0.
- [Release notes](https://github.com/Azure/azure-cli/releases)
- [Changelog](https://github.com/Azure/azure-cli/blob/dev/doc/try_new_features_before_release.md)
- [Commits](Azure/azure-cli@azure-cli-2.59.0...azure-cli-2.60.0)

---
updated-dependencies:
- dependency-name: azure-cli
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [azure/login](https://github.com/azure/login) from 2.1.0 to 2.1.1.
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@6b24568...6c25186)

---
updated-dependencies:
- dependency-name: azure/login
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ardenlinux#2125)

Bumps [azure-mgmt-compute](https://github.com/Azure/azure-sdk-for-python) from 30.6.0 to 31.0.0.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-python/blob/main/doc/esrp_release.md)
- [Commits](Azure/azure-sdk-for-python@azure-mgmt-compute_30.6.0...azure-mgmt-compute_31.0.0)

---
updated-dependencies:
- dependency-name: azure-mgmt-compute
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

gardenlinux#2129)

Bumps [google-cloud-compute](https://github.com/googleapis/google-cloud-python) from 1.17.0 to 1.19.0.
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-compute-v1.17.0...google-cloud-compute-v1.19.0)

---
updated-dependencies:
- dependency-name: google-cloud-compute
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ardenlinux#2127)

Bumps [azure-mgmt-network](https://github.com/Azure/azure-sdk-for-python) from 25.3.0 to 25.4.0.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-python/blob/main/doc/esrp_release.md)
- [Commits](Azure/azure-sdk-for-python@azure-mgmt-network_25.3.0...azure-mgmt-network_25.4.0)

---
updated-dependencies:
- dependency-name: azure-mgmt-network
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

- Include mlx5 drivers in initramdisk and load it, otherwise we have
  problems with the setup of the bond (NIC isn't known yet)

- Set the DNS on the bond, as cloud-init sets here things up statically,
  and therefore no DHCP info about the DNS

This file overrides the kublet config specifically put
there for gardener, and fails with it being there.
So we rather remove it.

Simply adding a second root.conf instructs systemd-repart to
create another root parition of equal size.

It isn't part of the gardenlinux repo (yet),
so get it in that way for now.

It's needed for the neutron OVS and the OVN driver.

Also add the loci-users for now. This probably
should be replaced with k8s means to map the users.

The gardenlinux kernel crashes currently
with the mlx5 driver.

The neutron agent will be member of the group openvswitch,
but not the openvswitch user itself.

This ensures, that they have the right permissions

The kernel can automatically detect the root based
on the GUID value. This marks the second partition as non-auto,
to disambiguate between the two partitions.
(Aside from the fact that the actual root has the label ROOT).

This is a bit of a sledge-hammer method, but for now disable
the watchdog, because it kicks in when doing a soft-reboot
or a system kexec call.
Both cut down the reboot time tremendously.
The proper way would be to find out why the watchdog is not
fed in those situations.

Probably it would be easier to disable cloud-init networking
and to do it completely ourselves, but now I have written it
that way that it starts after cloud-init-local
and before cloud-init (proper) to copy the settings from the bond
to the ovs config.

The clients run in the openvswitch group.
We create also a openvswitch user just in case,
as we might want to switch to that instead of root,
like SLES and possibly RHEL do.

This is rather slow, but it works.
We need to move that earlier somehow, maybe right in the initrd with
an kexec instead of this.